Poisoned Pipeline / Platforms / Developer workstation
Developer workstation
33 mapped incident(s) that touched this platform or registry.
Forged and timestamp-cloned commits planted a preinstall dropper in hugo-paper and mevn-cli
Git / GitHubnpmDeveloper workstation
5 mapped techniques
tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
npmGit / GitHubGitHub ActionsDeveloper workstationAI coding agentsVS Code / IDELinux distro / packagesWindows software
11 mapped techniques
@subql/common 5.8.3 published after a CI artifact swap
npmGitHub ActionsGit / GitHubCI/CD SaaSDeveloper workstationLinux distro / packages
8 mapped techniques
GhostAction steals CI secrets, then autoruns a stealer from a fake font
Git / GitHubGitHub ActionsVS Code / IDEDeveloper workstation
16 mapped techniques
Apex Accelerator published a malicious npm coding agent and a fake audit MCP
npmmacOS softwareWindows softwareMCPAI coding agentsGit / GitHubVS Code / IDEDeveloper workstation
7 mapped techniques
GlassWorm-hijacked contributor replaced OVHcloud CLI release assets on five published versions
Git / GitHubGitHub ActionsDeveloper workstationmacOS softwareLinux distro / packagesWindows software
6 mapped techniques
Seven fake NebulaAI npm packages drop a Windows KNTRAT at install
npmWindows softwareDeveloper workstation
5 mapped techniques
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
Forty-two RubyGems from reqthrottle_3474 run a reverse shell or a crypto stealer at install
RubyGemsDeveloper workstationLinux distro / packagesWindows software
8 mapped techniques
LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
PyPIDocker / containersGit / GitHubGitHub ActionsDeveloper workstationLinux distro / packagesmacOS softwareWindows software
12 mapped techniques
pub.dev universal_file_viewer ships XCSSET (infected maintainer)
pub.dev / DartmacOS softwareDeveloper workstation
4 mapped techniques
Hijacked AI coding assistant spreads Shai-Hulud
PyPIGit / GitHubAI coding agentsVS Code / IDEDeveloper workstation
8 mapped techniques
MALFEX npm campaign, including a native imgdecode loader with no install script
npmWindows softwareGit / GitHubDeveloper workstation
6 mapped techniques
Keyv / Cacheable ChainDrop worm
npmGitHub ActionsDeveloper workstationAI coding agentsKubernetes
8 mapped techniques
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
4 mapped techniques
@mastra scope poisoned via typosquat easy-day-js
npmAI coding agentsGit / GitHubLinux distro / packagesmacOS softwareDeveloper workstation
6 mapped techniques
Multi-org GitHub PAT campaign mass-cloned repositories
Git / GitHubDeveloper workstation
2 mapped techniques
Nx Console VS Code 18.95.0 (GitHub internal repo theft)
VS Code / IDEGit / GitHubDeveloper workstationGitHub Actions
3 mapped techniques
TanStack Mini Shai-Hulud (CVE-2026-45321)
npmGitHub ActionsAI coding agentsVS Code / IDEDeveloper workstation
18 mapped techniques
TraderTraitor interview repos point Terraform at a lookalike provider registry
TerraformGit / GitHubDeveloper workstationmacOS softwareLinux distro / packagesWindows softwareAWSGoogle Cloud
7 mapped techniques
Sha1-Hulud: The Second Coming
npmGitHub ActionsGit / GitHubLinux distro / packagesWindows softwareDeveloper workstation
4 mapped techniques
Shai-Hulud first wave (@ctrl/tinycolor)
npmGitHub ActionsGit / GitHubAI coding agentsDeveloper workstation
6 mapped techniques
Nx s1ngularity (stolen npm token via Actions injection)
npmGitHub ActionsAI coding agentsCI/CD SaaSGit / GitHubDeveloper workstation
8 mapped techniques
eslint-config-prettier phishing (npnjs.com) and node-gyp.dll
npmWindows softwareDeveloper workstation
4 mapped techniques
Spoofed Dependabot commits and secret-stealing Actions
Git / GitHubGitHub ActionsDeveloper workstation
7 mapped techniques
CircleCI December 2022 / January 2023 incident
CI/CD SaaSCircleCIDeveloper workstation
6 mapped techniques
Webmin 1.890–1.920 build-server backdoor
Linux distro / packagesDeveloper workstation
7 mapped techniques
CCleaner 5.33 signed ShadowPad backdoor
Windows softwareDeveloper workstationInstaller / update channel
8 mapped techniques